Appl. No. 09/6^Ml407 

Amdt. dated Feb. 19, 2 004 
Reply to Office Action of Nov. 20, 2003 

Amendments to the Claims : 

This Listing of Claims will replace all prior 
versions, and listings of claims in the application. 

Listing of Claims : 

Claim 1 (Currently amended) : A method for identifying a 
device acting as a server on a network, the method 
comprising: 

receiving data representing communications on the 
network, the data containing source device, destination 
device, data transfer protocol and data volume information 
for communications represented therein; 

identifying , from the received data, data relating to 
one or more relevant server protocols, and 

using the identified data, determining as a server 
device, the device which has the highest data volume for 
communications in which it is the source or destination 
device and in which communicationo involve at least a 
threshold number of other devices are involved . 

Claim 2 (Currently amended) : A method as claimed in 
claim 1, wherein the step of identifying data relating to 
relevant server protocols comprises: 

for each communication included in the management 
received data, comparing the data transfer protocol with at 
least one predefined server protocol, and 
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when the comparison results in a match, identifying 
the corresponding received data as relating to a relevant 
server protocol . 

Claim 3 (Original) : A method as claimed in claim 2, 
wherein the step of identifying further includes marking 
the identified data. 

Claim 4 (Original) : A method as claimed in claim 1, 
further comprising: 

after the step of identifying data relating to 
relevant server protocols, identifying the devices involved 
in the communications represented in the identified data 
using the source device and destination device information, 
and 

for each identified device, determining the total 
volume of data transferred during communications 
represented in the identified data involving the device 
using the volume information. 

Claim 5 (Original) : A method as claimed in claim 4, 
further comprising: 

after the step of determining the total volume of data 
transferred for each device, identifying the device with 
the highest total volume. 

Claim 6 (Original) : A method as claimed in claim 5, 
further comprising: 

after the step of identifying the device with the 
highest total volume, determining the number of other 
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devices involved in communications, represented in the 
identified data, with the identified device. 

Claim 7 (Original) : A method as claimed in claim 6, 
further comprising: 

after the step of determining the number of other 
devices, comparing the determined number against a 
predetermined threshold number, and 

if the determined number exceeds the predetermined 
threshold number, determining that the identified device 
with the highest total volume is a server device. 

Claim 8 (Original) : A method as claimed in claim 7, 
further comprising: 

removing data representing communications involving 
the determined server device from the identified data. 

Claim 9 (Original) : A method as claimed in claim 8, 
wherein the step of removing comprises unmarking the data. 

Claim 10 (Original) : A method as claimed in any preceding 
claim, wherein the received data comprises network traffic 
data . 

Claim 11 (Original) : A method as claimed in claim 10, 
further comprising, prior to the step of receiving, 
collecting said network traffic data at a location on the 
network using a network device selected from the group 
consisting of: managed network devices; traffic monitors; 
firewalls and packet capture devices. 
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Claim 12 (Original) : A method as claimed in claim 11, 
wherein the data is collected over a predetermined time 
period. 

Claim 13 (Original) : A method as claimed in claim 11, 
wherein the network traffic data is RM0N2 data. 

Claim 14 (Original) : A method as claimed in claim 1, 
wherein the threshold number is an integer greater than 
one . 



Claim 15 (Original) : A method as claimed in claim 1, 
wherein the relevant server protocols are selected from the 
group consisting of: HTTP; FTP; SMTP; Notes; DNS; IPX; SAP; 
Oracle; SIP; NetBeui; NFS; NetBios; NCP; SMB and H323 . 

Claim 16 (Currently amended) : On a computer readable 
medium, a computer program comprising: 

program means for receiving data representing 
communications on the network, the data containing source 
device, destination device, data transfer protocol and data 
volume information for communications represented therein; 

program means for identifying , from the received data, 
data relating to one or more relevant server protocols, and 

program means for using the identified data, 
determining as a server device, the device which has the 
highest data volume for communications in which it is the 
source or destination device and in which communi cat ions 
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involve at least a threshold number of other devices are 
involved . 

Claim 17 (Currently amended) : A computer program as 
claimed in claim 16, wherein the program means for 
identifying data relating to relevant server protocols 
comprises : 

program means for comparing, for each communication 
included in the management received data, the data transfer 
protocol with at least one predefined server protocol, and 

program means for identifying the corresponding 
management data as relating to a relevant server protocol, 
when the program means for comparing determines a match. 

Claim 18 (Original) : A computer program as claimed in 
claim 17, further comprising program means for marking the 
identified data. 

Claim 19 (Original) : A computer program as claimed in 
claim 16, wherein the program means for determining as a 
server device further comprises: 

program means for identifying, after identifying" data 
relating to relevant server protocols, the devices involved 
in the communications represented in the identified data 
using the source device and destination device information, 
and 

program means for determining, for each identified 
device, the total volume of data transferred during 
communications represented in the identified data involving 
the device using the volume information. 
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Claim 20 (Original) : A computer program as claimed in 
claim 19, wherein the program means for determining as a 
server device further comprises: 

program means for identifying, after said determining, 
the total volume of data transferred for each device, the 
device with the highest total volume. 

Claim 21 (Original) : A computer program as claimed in 
claim 20, wherein the program means for determining as a 
server device further comprises: 

program means for determining, after said identifying, 
the device with the highest total volume the number of 
other devices involved in communications, represented in 
the identified data, with the identified device. 

Claim 22 (Original) : A computer program as claimed in 
claim 21, further comprising: 

program means for comparing, after said determining 
the number of other devices, the determined number against 
a predetermined threshold number, and 

program means for determining, if the determined 
number exceeds the predetermined threshold number, that the 
identified device with the highest total volume is a server 
device . 

Claim 23 (Original) : A computer program as claimed in 
claim 22, further comprising: 
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program means for removing data representing 
communications involving the determined server device from 
the identified data. 

Claim 24 (Original) : A computer program as claimed in 
claim 16, wherein the received data comprises network 
traffic data, the program further comprising: 

program means for retrieving said network traffic data 
from a network device at a location on the network, and 

program means for storing the data in a data table in 
the form: 

[source] , [destination] , [application] , [volume] . 

Claim 25 (Original) : A computer program as claimed in 
claim 24, the network traffic data is RM0N2 data. 

Claim 26 (Currently amended) : Apparatus for identifying a 
device acting as a server on a network, the apparatus 
comprising : 

a network device for collecting data representing 
communications on the network, the data containing source 
device, destination device, data transfer protocol and data 
volume information for communications represented therein; 
and 

a processor for receiving the data and for 
identifying , from the received data, data relating to one 
or more relevant server protocols, said processor using the 
identified data to determine as a server device, the device 
which has the highest data volume for communications in 
which it is the source or destination device and in which 
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communications involve at least a threshold number of other 
devices are involved. 



Claim 27 (Original) : Apparatus as claimed in claim 26, 
further comprising : 

a data storage for storing data in a data table having 
the fields: 

[source] , [destination] , [application] , [volume] . 

Claim 28 (Original) : Apparatus as claimed in claim 27, 
wherein the data storage comprises a database. 
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